Critical Flaw in GiveWP Lets Attackers Take Over Your Site Without Logging In

If your site runs GiveWP, update it right now. A critical flaw lets an attacker take over your site without ever logging in.

What happened

GiveWP, a WordPress donation and fundraising plugin, had an unauthenticated PHP object injection vulnerability that chains into full remote code execution. Patchstack gave it a CVSS score of 10, the highest possible severity.

The attack chains three separate bugs together. GiveWP exposes a registration action that ignores WordPress’s own “anyone can register” setting, so an attacker can create an account even when public registration is turned off. A broken “safe unserialize” helper in the donation flow then lets that attacker feed malicious serialized data into the plugin, which gets written to the site’s database. From there, a gadget chain shipped inside GiveWP lets the attacker run arbitrary commands on the server.

On GiveWP 4.16.5.1 and earlier, a default installation is enough to be exploited: one published donation form and one active payment gateway, which describes most GiveWP sites out of the box. Versions 4.16.6 through 4.16.7.1 narrowed the attack path but didn’t close it.

Researcher Udin Chan reported the flaw to Patchstack on July 28. It is tracked as CVE-2026-82222. Patchstack says it rejected several of GiveWP’s patch attempts as incomplete before the vendor shipped a fix that closed the chain on August 27.

Who is affected

GiveWP has more than 100,000 active installations, mostly nonprofits and other organizations running online fundraising. Every version 4.16.7.1 and earlier is vulnerable.

What to do

Update GiveWP to version 4.16.7.2 immediately. The update also runs a database migration that scrubs any malicious serialized data already stored on your site, so updating cleans up past exploitation attempts as well as closing the hole.

One issue from the report remains open: the unauthenticated registration action still ignores the “anyone can register” setting, so strangers can still create accounts on your site even with public registration switched off. Patchstack says this can no longer be turned into remote code execution once the object injection flaw is patched, but it’s worth checking your user list for accounts you don’t recognize.

End of article